Security concepts: the five pillars and core principles

Domain 1 of the CISSP, Security and Risk Management, is the largest domain on the exam and the one that frames all the others. It asks you to think like a security leader: someone who understands what the organization is trying to achieve, what could stop it, and which protections are worth their cost. This course works through the whole domain in twelve lessons. This first lesson sets out the vocabulary that every later lesson, and every other CISSP domain, relies on: the five pillars of information security, the principles that guide control design, and the idea that security exists to serve the mission rather than the other way round.

CISSP is a registered mark of ISC2. This course is an independent study aid based on the publicly available exam outline. The quiz and exam questions are original practice items written for this course; they are not real exam questions and are not taken from any exam.

Where Domain 1 sits

The CISSP exam outline in force since 15 April 2024 weights Domain 1 at about 16 percent of the exam, the highest of the eight domains. ISC2 reviews its outlines every few years through a job task analysis, so check the ISC2 website before you sit the exam to confirm which outline applies. The 2024 outline divides Domain 1 into twelve sub-domains: professional ethics; security concepts; governance principles; legal, regulatory and compliance issues; investigation types; policies, standards, procedures and guidelines; business continuity requirements; personnel security; risk management; threat modeling; supply chain risk management; and security awareness, education and training. This course follows that order closely, grouping a few sub-domains together.

The five pillars

The 2024 outline names five security concepts together: confidentiality, integrity, availability, authenticity and nonrepudiation. The first three form the classic CIA triad; authenticity and nonrepudiation complete what ISC2 calls the five pillars. Every control you will study across the eight domains protects one or more of them.

Confidentiality means that information is disclosed only to people, processes and systems that are authorized to see it. Encryption, access control, data classification, clean-desk rules and non-disclosure agreements all protect confidentiality. Threats include eavesdropping, theft of devices, social engineering, misconfigured cloud storage and insiders who look at records they have no business reason to see. A related idea is sensitivity: how much harm unauthorized disclosure would cause. Confidentiality is not the same as privacy. Privacy concerns the rights of individuals over information about them; confidentiality is one of the tools used to honor those rights.

Integrity means that information and systems are accurate, complete and protected from unauthorized or accidental change. Hashing, digital signatures, input validation, change management, segregation of duties and version control protect integrity. Integrity failures are often subtle: a payroll rate changed by one decimal place, a tampered software update, a medical record edited without an audit trail. Integrity has two sides: preventing improper changes, and detecting them when they happen.

Availability means that authorized users can get timely and reliable access to information and systems when they need them. Redundancy, backups, capacity planning, patching, denial-of-service protection and business continuity planning protect availability. Availability is the pillar most directly tied to business operations: an hour of outage for an online retailer or a hospital's clinical systems has an immediate and measurable cost.

Authenticity means that a person, system or piece of data is genuine: that it is what it claims to be and comes from where it claims to come from. Authentication of users, mutual authentication of systems, certificates and message authentication codes protect authenticity. Nonrepudiation means that a party cannot credibly deny having performed an action, such as sending a message or approving a payment. Nonrepudiation usually depends on digital signatures backed by a trusted public key infrastructure, combined with reliable logs and time stamps. A shared password cannot provide nonrepudiation, because anyone who knew it could have acted.

The pillars can pull against each other. Strong encryption with tightly held keys protects confidentiality but can threaten availability if the keys are lost. Locking every record against change protects integrity but makes legitimate corrections harder. A security leader's job is not to maximize one pillar but to find the balance the business needs. A public website prioritizes integrity and availability; its content is meant to be seen. A merger negotiation file prioritizes confidentiality. An industrial control system often puts availability and integrity ahead of confidentiality, because a stopped or misbehaving process can hurt people.

Related concepts you will meet often

Several further terms appear throughout the CISSP and are worth fixing now. Identification is claiming an identity, such as typing a user name. Authentication is proving that claim, with something you know, have or are. Authorization is deciding what an authenticated identity may do. Accountability is the ability to trace actions to an identity, which depends on the first three and on auditing. Together these are sometimes called IAAA. Note that accountability requires unique identities: if three administrators share one account, no log can tell you which of them made a change.

Data has states as well as values. Data at rest sits in storage; data in transit moves across networks; data in use is being processed in memory. Each state needs its own protections, and a design that encrypts data at rest and in transit can still leak it in use. Data also has an owner, a custodian and users, roles you will see again in Domain 2.

Principles that guide control design

A small set of design principles recurs across the domains. They are worth memorizing because exam scenarios often test whether you can recognize one at work.

• Least privilege: give each person and process only the access needed for their task, and no more.
• Need to know: even with the right clearance, access a specific item of information only when your work requires it.
• Separation (or segregation) of duties: split critical tasks so that no single person can complete and conceal a harmful act, for example by separating the person who creates a supplier from the person who approves payments.
• Defense in depth: layer administrative, technical and physical controls so that one failure does not expose the asset.
• Fail securely: when a control fails, it should fail into a safe state that protects the asset, while life-safety systems such as fire exits fail open to protect people.
• Keep it simple, and secure by default and by design: complexity hides weaknesses, and secure settings should be the starting point rather than an option.
• Zero trust: do not grant trust because of network location; verify every request explicitly, based on identity, device and context.
• Trust but verify, and privacy by design: monitor that controls work as intended, and build privacy protections into systems from the start.

These principles are not absolute rules. Least privilege can slow urgent work if access requests take days; separation of duties is hard in a team of three. Part of thinking like a manager is choosing compensating controls, such as after-the-fact review of logs, when a principle cannot be applied fully.

Security serves the mission

The most important idea in Domain 1 is that security exists to enable the organization to achieve its mission safely, not to eliminate all risk. A hospital's mission is patient care; a security control that delays clinicians reaching records in an emergency may harm the mission it was meant to protect. A bank's mission includes moving money quickly and correctly; controls must protect integrity without stopping legitimate payments.

This is why the CISSP is often described as a manager's exam. Many scenario questions offer a technically clever option and a business-aligned option. The better answer usually starts from understanding requirements and risk, involves the right stakeholders, follows policy and law, and protects people first. When you see answer choices such as 'immediately reconfigure the firewall' and 'first determine the business impact and consult the system owner', ask which one a responsible senior leader would choose.

In the United States, this business-first view appears in federal guidance. The NIST Cybersecurity Framework 2.0, published in February 2024, added a Govern function so that cybersecurity strategy, roles and risk tolerance are set at the top of the organization, and NIST SP 800-37 builds its risk management framework around categorizing systems by mission impact before selecting controls. Many sector regulators, such as the federal banking agencies and the SEC, expect boards to oversee cyber risk.

As you work through the remaining lessons, keep returning to three questions. What is the organization trying to achieve? What could prevent it, and how likely and harmful would that be? Which response gives the best balance of protection, cost and usability? Those questions sit underneath governance, law, continuity, personnel security and risk management alike.